Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Limitations in the DriverEntry of disk upper filter vs normal drivers in boot?

henrik_meidahenrik_meida Member Posts: 63

Hi everyone,

sorry for the rookie question, but is there any limitation for the DriverEntries of disk upper filters vs normal drivers in boot?

For example, i assume there is no problem in accessing registry data of our driver in driverentry of upperfilters right? Are registry hives already loaded when our upperfilter's driverentry is called?


  • Don_BurnDon_Burn Member - All Emails Posts: 1,745

    The HKLM/System hive is available, but not necessarily the rest of the hives.

  • henrik_meidahenrik_meida Member Posts: 63

    @Don_Burn said:
    The HKLM/System hive is available, but not necessarily the rest of the hives.

    Thank you for the quick reply don, so this applies to every windows version right? i just want to make sure i can safely access my registry config data from my upper filter without getting any BSOD or something.

  • Don_BurnDon_Burn Member - All Emails Posts: 1,745

    You can be sure about the HKLM/System hive.

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 14,086

    An upper filter is a PnP driver, so the operating system had to get your information from the registry in order to find your driver.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • pwillypwilly Member Posts: 18

    Be careful. With a lower HID filter driver, we had once the case that the Registry HKLM\Software hive was sometimes not loaded at boot time. It turned out that on a frestly installed Windows 10 it was always loaded at boot time, but on an upgraded Windows 10 it was not loaded.

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,654

    As Mr Burn said… HKLM\System, but not anything else. That would include HKLM\Software. It’s not available at boot.

    Mr @henrik_meida this has been true since the first release of Windows NT, and remains correct today.


    Peter Viscarola

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 15 November 2021 Live, Online
Writing WDF Drivers TBD Live, Online
Developing Minifilters 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online